Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path). Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.3.0, < 5.3.49CPE matchmatch criteria | cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* | ||
>= 6.1.0, < 6.1.28CPE matchmatch criteria | cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* | ||
>= 6.2.0, < 6.2.18.1CPE matchmatch criteria | cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* | ||
>= 7.0.0, < 7.0.7.1CPE matchmatch criteria | cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.